Temporal phase shits in SCADA networks

Chen Markman; Avishai Wool; Alvaro A. Cardenas

doi:10.1145/3264888.3264898

Temporal phase shits in SCADA networks

Chen Markman, Avishai Wool, Alvaro A. Cardenas

School of Electrical Engineering

Tel Aviv University

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

In Industrial Control Systems (ICS/SCADA), machine to machine data traic is highly periodic. Previous work showed that in many cases, it is possible to create an automata-based model of the traic between each individual Programmable Logic Controller (PLC) and the SCADA server, and to use the model to detect anomalies in the traic. When testing the validity of previous models, we noticed that overall, the models have diiculty in dealing with communication patterns that change over time. In this paper we show that in many cases the traic exhibits phases in time, where each phase has a unique pattern, and the transition between the diferent phases is rather sharp. We suggest a method to automatically detect traic phase shifts, and a new anomaly detection model that incorporates multiple phases of the traic. Furthermore we present a new sampling mechanism for training set assembly, which enables the model to learn all phases during the training stage with lower complexity. The model presented has similar accuracy and much less permissiveness compared to the previous general Deterministic Finite Automata (DFA) model. Moreover, the model can provide the operator with information about the state of the controlled process at any given time, as seen in the traic phases.

Original language	English
Title of host publication	CPS-SPC 2018 - Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, co-located with CCS 2018
Publisher	Association for Computing Machinery
Pages	84-89
Number of pages	6
ISBN (Electronic)	9781450359924
DOIs	https://doi.org/10.1145/3264888.3264898
State	Published - 15 Oct 2018
Event	4th ACM Workshop on Cyber-Physical Systems Security and PrivaCy, CPS-SPC 2018, in conjunction with the 25th ACM Conference on Computer and Communications Security, CCS 2018 - Toronto, Canada Duration: 19 Oct 2018 → …

Publication series

Name	Proceedings of the ACM Conference on Computer and Communications Security

Conference

Conference	4th ACM Workshop on Cyber-Physical Systems Security and PrivaCy, CPS-SPC 2018, in conjunction with the 25th ACM Conference on Computer and Communications Security, CCS 2018
Country/Territory	Canada
City	Toronto
Period	19/10/18 → …

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 9 Industry, Innovation, and Infrastructure

All Science Journal Classification (ASJC) codes

Software
Computer Networks and Communications

Access to Document

10.1145/3264888.3264898

Cite this

Markman, C., Wool, A., & Cardenas, A. A. (2018). Temporal phase shits in SCADA networks. In CPS-SPC 2018 - Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, co-located with CCS 2018 (pp. 84-89). (Proceedings of the ACM Conference on Computer and Communications Security). Association for Computing Machinery. https://doi.org/10.1145/3264888.3264898

@inproceedings{3589e0dad6a34fd38bf506de9ad435e7,

title = "Temporal phase shits in SCADA networks",

abstract = "In Industrial Control Systems (ICS/SCADA), machine to machine data traic is highly periodic. Previous work showed that in many cases, it is possible to create an automata-based model of the traic between each individual Programmable Logic Controller (PLC) and the SCADA server, and to use the model to detect anomalies in the traic. When testing the validity of previous models, we noticed that overall, the models have diiculty in dealing with communication patterns that change over time. In this paper we show that in many cases the traic exhibits phases in time, where each phase has a unique pattern, and the transition between the diferent phases is rather sharp. We suggest a method to automatically detect traic phase shifts, and a new anomaly detection model that incorporates multiple phases of the traic. Furthermore we present a new sampling mechanism for training set assembly, which enables the model to learn all phases during the training stage with lower complexity. The model presented has similar accuracy and much less permissiveness compared to the previous general Deterministic Finite Automata (DFA) model. Moreover, the model can provide the operator with information about the state of the controlled process at any given time, as seen in the traic phases.",

author = "Chen Markman and Avishai Wool and Cardenas, \{Alvaro A.\}",

note = "Publisher Copyright: {\textcopyright} 2018 Association for Computing Machinery.; 4th ACM Workshop on Cyber-Physical Systems Security and PrivaCy, CPS-SPC 2018, in conjunction with the 25th ACM Conference on Computer and Communications Security, CCS 2018 ; Conference date: 19-10-2018",

year = "2018",

month = oct,

day = "15",

doi = "10.1145/3264888.3264898",

language = "الإنجليزيّة",

series = "Proceedings of the ACM Conference on Computer and Communications Security",

publisher = "Association for Computing Machinery",

pages = "84--89",

booktitle = "CPS-SPC 2018 - Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, co-located with CCS 2018",

address = "الولايات المتّحدة",

}

Markman, C, Wool, A & Cardenas, AA 2018, Temporal phase shits in SCADA networks. in CPS-SPC 2018 - Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, co-located with CCS 2018. Proceedings of the ACM Conference on Computer and Communications Security, Association for Computing Machinery, pp. 84-89, 4th ACM Workshop on Cyber-Physical Systems Security and PrivaCy, CPS-SPC 2018, in conjunction with the 25th ACM Conference on Computer and Communications Security, CCS 2018, Toronto, Canada, 19/10/18. https://doi.org/10.1145/3264888.3264898

Temporal phase shits in SCADA networks. / Markman, Chen; Wool, Avishai; Cardenas, Alvaro A.
CPS-SPC 2018 - Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, co-located with CCS 2018. Association for Computing Machinery, 2018. p. 84-89 (Proceedings of the ACM Conference on Computer and Communications Security).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Temporal phase shits in SCADA networks

AU - Markman, Chen

AU - Wool, Avishai

AU - Cardenas, Alvaro A.

PY - 2018/10/15

Y1 - 2018/10/15

N2 - In Industrial Control Systems (ICS/SCADA), machine to machine data traic is highly periodic. Previous work showed that in many cases, it is possible to create an automata-based model of the traic between each individual Programmable Logic Controller (PLC) and the SCADA server, and to use the model to detect anomalies in the traic. When testing the validity of previous models, we noticed that overall, the models have diiculty in dealing with communication patterns that change over time. In this paper we show that in many cases the traic exhibits phases in time, where each phase has a unique pattern, and the transition between the diferent phases is rather sharp. We suggest a method to automatically detect traic phase shifts, and a new anomaly detection model that incorporates multiple phases of the traic. Furthermore we present a new sampling mechanism for training set assembly, which enables the model to learn all phases during the training stage with lower complexity. The model presented has similar accuracy and much less permissiveness compared to the previous general Deterministic Finite Automata (DFA) model. Moreover, the model can provide the operator with information about the state of the controlled process at any given time, as seen in the traic phases.

AB - In Industrial Control Systems (ICS/SCADA), machine to machine data traic is highly periodic. Previous work showed that in many cases, it is possible to create an automata-based model of the traic between each individual Programmable Logic Controller (PLC) and the SCADA server, and to use the model to detect anomalies in the traic. When testing the validity of previous models, we noticed that overall, the models have diiculty in dealing with communication patterns that change over time. In this paper we show that in many cases the traic exhibits phases in time, where each phase has a unique pattern, and the transition between the diferent phases is rather sharp. We suggest a method to automatically detect traic phase shifts, and a new anomaly detection model that incorporates multiple phases of the traic. Furthermore we present a new sampling mechanism for training set assembly, which enables the model to learn all phases during the training stage with lower complexity. The model presented has similar accuracy and much less permissiveness compared to the previous general Deterministic Finite Automata (DFA) model. Moreover, the model can provide the operator with information about the state of the controlled process at any given time, as seen in the traic phases.

UR - http://www.scopus.com/inward/record.url?scp=85056700212&partnerID=8YFLogxK

U2 - 10.1145/3264888.3264898

DO - 10.1145/3264888.3264898

M3 - منشور من مؤتمر

T3 - Proceedings of the ACM Conference on Computer and Communications Security

SP - 84

EP - 89

BT - CPS-SPC 2018 - Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, co-located with CCS 2018

PB - Association for Computing Machinery

T2 - 4th ACM Workshop on Cyber-Physical Systems Security and PrivaCy, CPS-SPC 2018, in conjunction with the 25th ACM Conference on Computer and Communications Security, CCS 2018

Y2 - 19 October 2018

ER -

Temporal phase shits in SCADA networks

Abstract

Publication series

Conference

UN SDGs

All Science Journal Classification (ASJC) codes

Access to Document

Other files and links

Fingerprint

Cite this